915d7cbbcceb3d937e8c9af28cfd40771d764157703036d68fc1372e5cbcf333

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26-03-2024 21:23

Target

e02053e2541efe544dc84bc537740ac8.dll
Size

201KB
MD5

e02053e2541efe544dc84bc537740ac8
SHA1

c47fcfc96ed786220e19e50bd4bb1c657f07a428
SHA256

915d7cbbcceb3d937e8c9af28cfd40771d764157703036d68fc1372e5cbcf333
SHA512

b33d2e5bc73efeb0b9882929fbffc994a8c65e05932955b71b27ee9c7aa46754828e07a3369d034b44195468851e1ce858f295132243ad10b17dc90e29c1ea00
SSDEEP

3072:q/7PPaf56AVMYeRKPhG81Wcr1quAdFI9r71D9ptG1zmHGExgckukps07vT9k93h7:qzXKJl481gUrB9mExxkukpR9I3hoSp

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/4492-0-0x0000000000400000-0x0000000000465000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4952	4492	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4556 wrote to memory of 4492	4556	rundll32.exe	85
PID 4556 wrote to memory of 4492	4556	rundll32.exe	85
PID 4556 wrote to memory of 4492	4556	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e02053e2541efe544dc84bc537740ac8.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4556
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e02053e2541efe544dc84bc537740ac8.dll,#1
  2⤵
  PID:4492
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4492 -s 560
    3⤵
    - Program crash
    PID:4952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 4492 -ip 4492
1⤵
PID:1136

memory/4492-0-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/4492-1-0x00000000010A0000-0x00000000010B4000-memory.dmp

Filesize
80KB

Download